CVE-2018-8718 Cross-Site Request Forgery in Jenkins Mailer Plugin
HighCVSS 8.0
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.jenkins-ci.plugins/mailer(Maven) | < 1.21 | 1.21 |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.1 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.10 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.11 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.12 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.12-beta-1 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.13 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.14 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.15 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.16 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.17 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.18 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.19 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.2 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.20 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.3 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.4 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.5 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.6 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.7 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.8 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | = 1.9 | No fix listed |
| org.jenkins-ci.plugins/mailer(Maven) | <= 1.20 | No fix listed |
| jenkins mailer | <= 1.20 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- jenkins.io vendor-advisory
- 44843 exploit third-party-advisory vdb-entry
- [oss-security] 20180326 Multiple vulnerabilities in Jenkins plugins mailing-list third-party-advisory
- 103691 third-party-advisory vdb-entry
- github.com